1ebefbd518bca8250bfaa65253f49085d68f7dc98b916f3a6dde487402a8be86

Resubmissions

28/03/2025, 09:59

250328-l1brkst1hy 3

28/03/2025, 09:58

250328-lzqjcawn16 3

Analysis

max time kernel
592s
max time network
599s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

2.7MB
MD5

ae1be75e4148eb557c74557b7c42b6b6
SHA1

9ea704aa968964afa4ed45311ca557a11c77b359
SHA256

1abe1edf1a59d0be0ea595b7a3c1627fbd1280802ccab0d60a94fc4c081df0db
SHA512

25db098d4a3d8c82175761e5079713a617dd03bd73a54c4de6af5e72c4b8b5a111ca22bd4b016b6f674a2147b4b874ae9c6a07b9ed1b78b934c0751dac63db02
SSDEEP

49152:N9r+ohtfb7A7idFPYtVNcQqYWxyskqElfGG3A/Tp8i8H9Pm76rLjFGPMyRHw2A+:zhFw7YFARqYwElfv3AF976rLjAPMy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads